openwebmonitor3

maintainer AsukaMinato · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'npm i sqlite3@5.0.2' during prepare() without pinning the package via a lockfile or declaring it in source=() with integrity verification. This fetches and installs an npm package at build time from the npm registry without any checksum validation in the PKGBUILD itself. Additionally, the primary source is 'local://OpenWebMonitor3-3.5.2.zip' which is unusual (a local file not fetched from a verifiable upstream URL), and the package extracts from a .exe file. The sqlite3 native binary is fetched from the official TryGhost/node-sqlite3 GitHub releases with checksums, which is fine, but the npm install of sqlite3@5.0.2 (a different version than the binary v5.1.6) without integrity verification is a genuine supply-chain concern — the npm package could be compromised or version-squatted. The license is listed as 'proprietary' with no source URL for the actual software binary, making provenance unclear. These factors together constitute a real medium-severity supply-chain risk.

Triggered rules

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:33 npm i sqlite3@5.0.2

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD runs 'npm i sqlite3@5.0.2' during prepare() without pinning the package via a lockfile or declaring it in source=() with integrity verification. This fetches and installs an npm package at build time from the npm registry without any checksum validation in the PKGBUILD itself. Additionally, the primary source is 'local://OpenWebMonitor3-3.5.2.zip' which is unusual (a local file not fetched from a verifiable upstream URL), and the package extracts from a .exe file. The sqlite3 native binary is fetched from the official TryGhost/node-sqlite3 GitHub releases with checksums, which is fine, but the npm install of sqlite3@5.0.2 (a different version than the binary v5.1.6) without integrity verification is a genuine supply-chain concern — the npm package could be compromised or version-squatted. The license is listed as 'proprietary' with no source URL for the actual software binary, making provenance unclear. These factors together constitute a real medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asuka Minato <i at asukaminato dot eu dot org>
    
      2pkgname=openwebmonitor3
    
      3pkgver=3.5.2
    
      4pkgrel=2
    
      5pkgdesc="通用型网页内容监控工具"
    
      6arch=(x86_64 aarch64)
    
      7url="http://owm.fatecore.com/"
    
      8license=('proprietary')
    
      9depends=(electron11 glibc gcc-libs bash)
    
      10makedepends=(asar npm)
    
      11source=("local://OpenWebMonitor3-3.5.2.zip"
    
      12	"patch"
    
      13	$pkgname.desktop)
    
      14source_x86_64=(
    
      15	"https://github.com/TryGhost/node-sqlite3/releases/download/v5.1.6/napi-v6-linux-glibc-x64.tar.gz"
    
      16)
    
      17source_aarch64=(
    
      18	"https://github.com/TryGhost/node-sqlite3/releases/download/v5.1.6/napi-v6-linux-glibc-arm64.tar.gz"
    
      19)
    
      20sha256sums=('f788d367c73e5f287405452bce6b8d8b1f263e76fd4ff76a8c8b42e8e6e8f8a4'
    
      21            'dd6f93c153dc09ba60dae10bb3a16912c69469c9715231310ade3b85977fab03'
    
      22            '91044ca6e7e70b8ff72f4cb758d5e82395f6e4fda957020f27a7eaa75c4c7cf7')
    
      23sha256sums_x86_64=('d31475a48731bda50747d4187f46f028565e84086473b55e165e9e4447430164')
    
      24sha256sums_aarch64=('4cfa941ac72e76eac65bb1e6e4668fd5c94c2179c8680c4a445f77644e819d08')
    
      25options=(!emptydirs)
    
      26
    
      27prepare() {
    
      28	bsdtar -xvpf ./**/*.exe resources/
    
      29	rm -rf $srcdir/{*.gz}
    
      30	pushd resources
    
      31	asar e app.asar ./app
    
      32	pushd app
    
      33	npm i sqlite3@5.0.2
    
      34	patch -p1 --verbose <$srcdir/patch
    
      35	pushd node_modules
    
      36	rm -rf node-gyp sqlite3/tools
    
      37	pushd sqlite3/lib/binding/
    
      38	cp -a $srcdir/napi-v* ./
    
      39	mv napi-v6-linux-*-x64 napi-v6-linux-x64
    
      40	find $srcdir \( \
    
      41		-name "Dockerfile" \
    
      42		-or -name "*.h" \
    
      43		-or -name "*.ts" \
    
      44		-or -name "package-lock.json" \
    
      45		-or -name "*.cc" \
    
      46		-or -name "cli.js" \
    
      47		-or -name "*.py" \
    
      48		-or -name "build.js" \
    
      49		\) -type f -delete
    
      50	find $srcdir \( \
    
      51		-path "*/bin/*" \
    
      52		-or -path "*/test/*" \
    
      53		-or -path "*/example/*" \
    
      54		-or -path "*/examples/*" \
    
      55		-or -path "*/.bin/*" \
    
      56		\) \( -type f -or -type l \) -delete
    
      57	find $srcdir -name "*.1" -path "*/man/*" -type f -delete
    
      58	find $srcdir \( -name "package-lock.json" -or -name "Makefile" \) -delete
    
      59}
    
      60
    
      61package() {
    
      62	install -d $pkgdir/opt/$pkgname/
    
      63	cp -a $srcdir/resources/app $pkgdir/opt/$pkgname/
    
      64	printf "#!/bin/bash
    
      65exec electron11 /opt/$pkgname/app \"\$@\"
    
      66" | install -Dm755 /dev/stdin $pkgdir/usr/bin/$pkgname
    
      67	find $pkgdir -name "icon.png" -print -type f -exec install -Dm644 {} $pkgdir/usr/share/pixmaps/$pkgname.png \;
    
      68	install -vDm644 $pkgname.desktop -t $pkgdir/usr/share/applications/
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2